Ai regulation and compliance

AI regulation

AI regulation and data governance

Artificial intelligence and advanced data processing are now central to digital operations, commercial strategy and regulatory risk. Organisations must be able to demonstrate that AI systems are designed, developed and deployed within a defensible governance framework. This page introduces the regulatory landscape for AI regulation and data governance, explains the core governance disciplines and links to Bratby Law’s related pages.

What AI regulation and data governance means

AI and data governance refers to the structures, processes and controls through which organisations manage the risks and responsibilities associated with AI systems and complex data use. Effective governance requires:

  • clear allocation of accountability
  • risk identification and management throughout the AI lifecycle
  • control over data inputs, training data and data provenance
  • validation and oversight of models and automated decision-making
  • appropriate transparency, explainability and assurance
  • preparedness for investigations, audits or regulatory engagement

Governance frameworks must be proportionate to the nature of the AI systems and their potential impact on individuals, markets and society.

AI regulation landscape

AI and data governance is shaped by a combination of statutory requirements, regulatory expectations and international standards.

United Kingdom

The UK undertakes AI regulation through existing legislation and sector-based regulators rather than a single comprehensive statute. Key instruments include:

Regulators expect organisations to manage risk through structured governance and to document how systems meet regulatory standards.

European Union

The EU AI Act introduces a harmonised framework applying from 2026 onwards for AI regulation. It classifies AI systems by risk and imposes specific requirements on high-risk and general-purpose AI models. The EU Data Act and Digital Services Act impose further obligations on data access, sharing and platform governance.

UK organisations may be caught by EU AI regulation requirements where AI systems are placed on the EU market or used in the EU.

International Ai regulation and governance standards and guidance

Frameworks influential in shaping governance include:

Organisations operating across borders should aim for governance structures that are interoperable across these frameworks.

Core governance disciplines

Accountability and oversight

Boards and senior management must take responsibility for the use of AI within the organisation. Effective oversight requires:

  • clear roles and delegated responsibilities
  • governance committees or equivalent decision-making forums
  • accountability frameworks for development, procurement and deployment
  • auditability and documented rationale for significant decisions

Risk management

AI must be subject to structured risk assessment and mitigation, covering:

  • model behaviour and performance
  • algorithmic fairness and bias
  • data quality, provenance and ethics
  • robustness, security and resilience
  • risks from general-purpose and third-party AI models
  • impacts on customers, employees and wider society

Data governance

AI governance is inseparable from data governance. Organisations should maintain:

  • clear data inventories and lineage
  • controls for data access and quality
  • lawful bases for training data and model inputs
  • protection against data leakage, reconstruction or inversion attacks
  • contractual controls covering third-party data and APIs

Model governance and validation

Model governance requires:

  • documentation of model design, assumptions and intended use
  • validation and testing before deployment
  • monitoring of performance, drift, and unintended outcomes
  • human oversight, including override and escalation processes
  • post-market monitoring where required by regulation

Supplier and foundation-model governance

Many firms rely on external AI tools and general-purpose AI models. Governance should include:

  • due diligence on model providers
  • contractual allocation of responsibilities and liability
  • assessments of data use, IP rights and restrictions
  • controls for API-based or embedded model use

Incident management and reporting

Organisations should maintain:

  • incident response processes for AI-related failures
  • channels for internal reporting and escalation
  • compliance with statutory reporting requirements
  • readiness for regulatory engagement and investigations

Interaction with other regulatory regimes

AI governance intersects with multiple regulatory obligations, including:

  • data protection, including automated decision-making and profiling
  • Online Safety Act duties for platforms and content providers
  • consumer protection law and fairness in automated outcomes
  • competition law issues arising from the use of AI in pricing, ranking or market operations
  • safety regulation for systems relevant to critical infrastructure or autonomous functionality

Sector regulators increasingly expect organisations to evidence governance frameworks and decision-making.

Cross-border considerations

International businesses must manage:

  • divergence between UK and EU regimes in timing, scope and terminology
  • extraterritorial reach of the EU AI Act and US state-level regimes
  • supply-chain risk where models rely on third-country data or components
  • compliance with local standards in high-risk jurisdictions

A harmonised approach reduces audit duplication and strengthens defensibility.

Future direction

The regulatory environment for AI regulation and data governance will continue to evolve. Anticipated developments include:

  • further UK guidance on high-risk use and regulatory assurance
  • implementation of the EU AI Act and related standards
  • greater supervisory focus on general-purpose AI models
  • mandatory transparency and audit requirements for certain sectors
  • increased cross-regulator coordination, including Ofcom, ICO and CMA

Firms should adopt governance structures capable of scaling as regulatory expectations increase.

How Bratby Law assists with AI regulation and governance

We support clients in building, documenting and improving AI and data governance frameworks. Our work includes:

  • AI governance frameworks aligned with UK, EU and international standards
  • risk assessments for high-risk and general-purpose AI
  • data governance and lawful use of training data
  • model governance structures and lifecycle controls
  • AI-related contractual frameworks and supplier management
  • regulatory engagement and preparation for supervision or assurance
  • internal policies, standards and training materials
  • readiness assessments for the EU AI Act and the Data (Use and Access) Act

Our advice is practical, sector-informed and centred on creating governance that works for both compliance and innovation.

Why choose Bratby Law for AI regulation and governance

  • expert regulatory insight into AI, data protection and digital technologies
  • experience advising clients in regulated and data-intensive sectors
  • practical understanding of technical, operational and governance challenges
  • commercially grounded advice tailored to organisational risk
  • integrated approach spanning legal, regulatory and technical issues

Need AI compliance advice?

Book a call

Independent directory rankings

Our specialist expertise is recognised in major independent legal directories:

  • Chambers & Partners: Rob Bratby is ranked in the UK Guide 2026 in the “Telecommunications” category: Chambers
  • The Legal 500: Rob Bratby is listed as a “Leading Partner – Telecoms” in London (TMT – IT & Telecoms): The Legal 500
  • Lexology: Rob Bratby is featured on Lexology’s expert profiles (Global Elite Thought Leader): Lexology
1 | bratby law | telecoms | ai | data
Ai regulation 5 | bratby law | telecoms | ai | data
2 | bratby law | telecoms | ai | data
Ai regulation 6 | bratby law | telecoms | ai | data

What clients say

  • “…one of those rare lawyers who really does understand the business imperatives behind the legal situations businesses find themselves in.”

    “I worked with Rob over many years whilst I was at Orange. He is one of those rare lawyers who really does understand the business imperatives behind the legal situations businesses find themselves in. Most notably he provided first class support to me and my team on a high profile / high value joint venture network sharing deal. His ability to see both the detail and the bigger strategic picture were enormously helpful.”
    Amanda Doyle
    (Former) General Counsel, Orange UK

  • “I would highly recommend Rob and his team.”

    “I have had the pleasure of working with Rob now on a number of occasions and engagements with clients. Rob is one of the most knowledgeable people I have come across in the Telecommunications industry, both in his comprehensive understanding of the law for various countries and in the application of this law and what it means for Operators. This is complemented by his generosity with sharing his knowledge, and the friendly style with which he works. I would highly recommend Rob and his team.”
    Nick White
    (Former) Deloitte

  • “I would recommend Rob for any major Telecoms project”

    “I worked with Rob to introduce One Touch Switching for broadband and fixed voice, which launched successfully with almost two million customers using the service to date. Rob is a first class Legal Counsel with exceptional legal and regulatory knowledge enabling him to give insightful strategic guidance to the ExCo and the Board. He is highly trusted by Directors and easy to work with. I would recommend Rob for any major Telecoms project.”
    Toby Lovell
    (Former) Chief of Staff, The One Touch Switching Company

External links

United Kingdom primary legislation

Regulatory authorities and guidance

UK government AI policy frameworks

EU legislation

International frameworks and standards

Sector-specific guidance

Also see

Frequently asked questions

What is AI and data governance?

AI and data governance refers to the frameworks, processes and controls through which organisations manage the risks and responsibilities associated with developing and using AI systems.

What are the first steps in creating an AI governance framework?

A structured starting point is to map AI use cases, classify them by risk and build governance, documentation and oversight processes proportionate to that risk.

Does the EU AI Act apply to UK organisations?

The EU AI Act may apply to UK organisations whose AI systems are placed on the EU market or used in the EU. Many businesses require governance structures that cover both UK and EU requirements.

What is the main source of AI regulation in the UK?

The UK does not have a single AI Act. AI regulation and compliance are governed primarily through existing legislation such as the Online Safety Act 2023, the Data (Use and Access) Act 2025, the UK GDPR and the Data Protection Act 2018, interpreted and enforced by sectoral regulators including Ofcom, the ICO, the FCA and the CMA.

Ai regulation and compliance

AI Regulation